DEV Community

Anoymask
Anoymask

Posted on

skynox7: D-Link, Ubiquiti, and SAP Devices Repurposed into Pawns.app Residential Proxies

#security #threatintel

1. Basic Information

Compromises installing Pawns.app without the owners' consent have been confirmed in 34 countries. In addition to unauthorized bandwidth usage, some devices were left with SSH keys for re-access. The mere attribute of a residential proxy does not distinguish between legitimate and unauthorized traffic.

2. In Brief

Threat actor skynox7 invaded edge devices using known vulnerabilities, installed the Pawns.app client, and resold the victims' network connections as paid residential proxies. GreyNoise identified at least 143 devices across 34 countries, with SSH public keys added to some of them.

3. Attack Flow

Path 1: Confirmed Proxyjacking Path

  1. The attacker scans for public edge devices and exploits product-specific known CVEs.
  2. The Pawns.app client is downloaded and executed on the device.
  3. The client is linked to skynox7's payout account, providing the victim's network connection as a residential proxy.
  4. SSH public keys are added to some devices to leave a re-access path even after Pawns.app is stopped.

4. Attacker Position and Execution Location

  • A remote attacker reaching public interfaces such as NAS, NVR, and SAP NetWeaver from the internet.

5. Victim and Administrator Perspective

  • Victims and Users: May experience reduced internet speed or IP blocks from external services.
  • Administrators: May observe unknown processes, added SSH keys, long-term outbound TLS connections, abuse notifications, and suspicious authentication from the same IP.

6. Success and Failure Conditions

Success Conditions

  • Vulnerable or end-of-life (EOL) edge devices are exposed to the internet.
  • Outbound communication and execution of Pawns.app are permitted.

Failure Conditions and Countermeasures

  • Patch the target CVEs, replace EOL devices, and restrict management interfaces to VPNs or trusted networks.
  • For the UniFi Network application, Bulletin 023 confirms that the issue was fixed in version 6.5.54 and later. Do not apply this fix level to UniFi Video NVRs; compare the actually running application with the corresponding fixed version.
  • Use application allowlists and outbound traffic controls to block unauthorized proxy clients.

7. What Happens Upon Success

  • Victim IPs and bandwidth are used to relay third-party traffic.
  • This leads to a degraded corporate IP reputation, handling abuse notifications, and re-compromise through additional SSH persistence.

8. Observable Logs

The following are candidates for investigation within your organization. Availability depends on products, permissions, log settings, and retention periods, and the absence of records does not prove a lack of compromise.

  • Email: No email vectors specific to this incident have been confirmed.
  • Proxy / SWG / DNS: Inference: Identify Pawns.app-related domains, unknown proxy services, and continuous outbound connections.
  • Endpoint / EDR: Inference: Identify unknown binaries on edge devices, autostart configurations, and changes to SSH authorized_keys.
  • Identity / IdP: Inference: Detect authentications to multiple accounts from the same residential proxy IP combined with device mismatches.
  • SaaS / Cloud: Inference: Review SAP NetWeaver management, upload logs, and change history.
  • Network: Inference: Observe exploit requests from 209.99.190.80, unusual bulk relay traffic, and long-duration sessions to multiple destinations.

9. Assessing Attack Success

Confirmed in Public Information

  • Subsequent Compromise Confirmed: Public information: GreyNoise confirmed the installation of Pawns.app, proxy operation, and the addition of some SSH keys on real devices. Scope: Activity confirmed by GreyNoise

Separate contact, execution, persistence, information acquisition, and external transmission; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Target CVEs, Pawns.app, 209.99.190.80, and unknown SSH keys.
  • Initial Verification: Check device models, firmware, exposure scope, outbound traffic, and management access.
  • Endpoint / Server Investigation: Preserve the file system, processes, autostart settings, authorized_keys, and firmware images.
  • Authentication / Cloud Investigation: Compare device management accounts with internal SaaS authentications originating from the proxy IP.
  • Subsequent Operations: Track Pawns.app traffic, SSH re-access, internal reconnaissance, and deployment to other devices.
  • Containment: Stop public exposure, isolate the network, reinstall firmware or replace devices, and rotate credentials and SSH keys.
  • Decision Categories: Separate scanning, exploitation, client installation, proxy operation, and SSH persistence.

11. Defense and Detection Ideas

  • Single Event: Inference: Treat unauthorized Pawns.app execution or authorized_keys modifications as investigation candidates. Do not infer compromise solely from legitimate consensual Pawns.app installations or residential proxy IPs.
  • Timeline Correlation: Correlate exploit requests -> binary download -> long-duration outbound traffic -> SSH key addition.
  • Threat Hunting: Search for all edge devices possessing target CVEs and traffic destined for residential proxies.
  • Log Limitations: Because many edge devices lack process and file auditing, network telemetry and configuration diffs are critical.
  • Priority Countermeasures: Prioritize patching, replacing EOL devices, making management interfaces private, operating outbound traffic allowlists, and managing SSH keys.

12. Facts / Inference / Hypothesis

Facts

  • GreyNoise confirmed activity where at least 143 edge devices in 34 countries were converted into Pawns.app residential proxies.
  • GreyNoise reported the exploitation of CVE-2024-3272/3273 in D-Link ShareCenter, CVE-2021-44228 on devices designated as Ubiquiti UniFi Video NVRs, and CVE-2025-31324 in SAP NetWeaver Visual Composer as attack paths. Product names and version matches must be verified against physical devices and vendor information.
  • Ubiquiti Security Advisory Bulletin 023 states for Log4j CVE-2021-44228 that the affected product is the UniFi Network application, affected versions are 6.5.53 and earlier, and the fix is version 6.5.54 and later.
  • Hikvision and Dahua DVRs/NVRs were also targeted, but specific intrusion vulnerabilities have not been identified.
  • Following compromise, the Pawns.app client is launched under the attacker's monetization account to sell the victim's bandwidth and IP reputation.
  • SSH public keys for re-access were added to some devices.
  • GreyNoise disclosed the attacking IP 209.99.190.80 and the payout account skynox7@proton.me.
  • GreyNoise does not classify the Pawns.app binary itself as malicious, distinguishing whether it is installed without the owner's consent.

Inference

  • When authentications to multiple corporate accounts originate from the same residential proxy IP, it may indicate proxy usage rather than user travel.

Hypothesis

No additional hypotheses. Unconfirmed items are documented in "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high Invades public edge devices using multiple known CVEs. Source
T1090 Proxy high Deploys Pawns.app and operates as a residential proxy node. Source
T1098.004 Account Manipulation: SSH Authorized Keys high SSH public keys were added to some devices. Source

14. Unknowns and Additional Investigation

  • The total number of compromised devices, initial intrusion methods for Hikvision/Dahua, contents of relayed third-party traffic, and additional lateral movement from compromised devices remain unknown.
  • The correspondence between GreyNoise's "UniFi Video NVR" designation and Ubiquiti's official target, the UniFi Network application, is unconfirmed. The application name and version actually running on the observed devices, as well as the basis for identifying the exploited target, are required.

15. Impact on SOCs and Organizations

Residential IPs and normal location information do not guarantee that a communication entity is trustworthy. On the other hand, merely detecting Pawns.app or residential proxy IP addresses does not confirm a compromise; assessments must combine vulnerabilities in public devices, authorization of installations, changes to SSH keys and processes, and discrepancies in authentication devices.

16. Summary by Role

  • For SOCs: Correlate requests for known CVEs, Pawns.app processes, SSH authorized_keys modifications, and unusually long outbound communications.
  • For Administrators: Isolate and update EOL devices, close public management interfaces, and remove Pawns.app along with unknown SSH keys.
  • For Users: This is a device-side compromise requiring no user interaction. Pay attention to communication delays or connection change notices from administrators.

Top comments (0)